Fastino Labs Open-Sources GLiGuard, a 300M-Parameter Moderation Model That Matches Much Larger Systems

Fastino Labs has open‑sourced GLiGuard, a 300‑million‑parameter safety moderation model, publishing its weights and code on Hugging Face under an Apache 2.0 license. The release targets the operational cost and latency problems teams face when guardrail checks must run on every prompt and every model response, making a compact model available to run locally or in production. This design aims to make per‑turn moderation more practical for builders who need checks both before and after generation.

GLiGuard performs four moderation tasks in a single forward pass. It applies binary safety classification to both user prompts (pre‑generation) and model responses (post‑generation); detects jailbreak strategies across 11 predefined strategies — examples include prompt injection, roleplay bypass, instruction override and social engineering; classifies harm across 14 categories such as violence, sexual content, hate speech, PII exposure, misinformation, child safety and copyright issues; and performs refusal detection.

Architecturally, GLiGuard is an encoder‑based model that frames each moderation need as a text classification problem. The model encodes the input together with task definitions and candidate labels, scores every label simultaneously, and returns the highest‑scoring label for each task. Because it outputs labels rather than autoregressive tokens, extending the model to cover additional safety dimensions increases the label set passed into the encoder rather than the number of sequential generation steps.

Fastino Labs reports that GLiGuard achieves up to 16× higher throughput and 16.6× lower latency than current state‑of‑the‑art moderation models while matching or exceeding the accuracy of models 23× to 90× larger across nine safety benchmarks. Those performance claims highlight a tradeoff: smaller, parallel classification architectures can rival much larger decoder‑only instantiations on standard safety evaluation suites when designed for multi‑task scoring.

The release is positioned against existing open‑source guardrail models that are decoder‑only and scale into the billions of parameters — examples include LlamaGuard4 (12B), WildGuard (7B), ShieldGemma (27B) and NemoGuard (8B). Decoder architectures produce safety verdicts autoregressively, which can compound latency because multiple moderation criteria are typically generated sequentially rather than scored in parallel. its Apache‑2.0 licensing and Hugging Face hosting lower barriers to experimentation and deployment. Teams should still validate the model against their own policies and threat models before production use.